Security

Eight answers to the questions an HR director or CIO asks before entrusting internal documents and employee data to a tool. This page complements the Privacy policy and the Data processing agreement.

1. Where is your data?

In France. The database and files are hosted in Paris (Supabase, eu-west-3 region) and the application runs in Paris (Vercel, cdg1 region). Two categories of subprocessors are located in the United States: transactional email delivery (Resend) and the AI providers (Anthropic, OpenAI). These transfers are covered by standard contractual clauses and our additional clauses, and these providers do not train their models on your data. The full list is public: subprocessors.

2. Who can see what?

Each customer company is isolated from the others: every query is filtered on the signed-in user's company, and automated tests check this isolation on every release. Inside your workspace, roles are separated: a manager only sees their own new hires, a buddy only their mentees, a new hire only their own journey. 360° feedback reaches managers aggregated and anonymised.

3. How do your employees sign in?

With their Google or LinkedIn account, with a single-use sign-in link sent by email (valid for fifteen minutes, consumed once), or with a password. A suspended or deleted account loses access on every sign-in path.

4. What is encrypted?

Everything in transit (TLS 1.3, HSTS) and at rest (AES-256 on disk). Conversations between your employees and the AI assistant are additionally encrypted at the application level with a key derived per company: losing that key makes the conversations unrecoverable, including for us. That is by design.

5. Who did what?

An audit log records sensitive actions: creating, editing and deleting a new hire, publishing a journey, changing the assistant, GDPR exports and deletions. Each entry keeps the action, the object, the author, the IP address and the time.

6. How do you export or erase an employee's data?

From the HR interface, in one click. The export (GDPR articles 15 and 20) produces a complete file; deletion (article 17) anonymises personal data immediately, with no way back. Data of a departed employee is deleted automatically three years after the end of their contract.

7. What happens in case of an incident?

Daily database backups, with a tested restore procedure. In case of a data breach, contractual commitment to notify within 72 hours (DPA § 6.5). To report a vulnerability: security@weloom.fr, acknowledged within two working days.

8. What about electronic signature?

Contracts and policies signed in Weloom go through a French electronic signature provider, compliant with the eIDAS regulation (simple electronic signature), with timestamping. Weloom never stores card numbers: payments go through Stripe.

Any security or GDPR question, including a security questionnaire from your IT team: dpo@weloom.fr.